Meta says it’s shut down a pro-Russian disinformation network, warns of a social media hacking operation

By Brian Fung, CNN

(CNN) -- Facebook's parent Meta said Monday it has caught dozens of fake, pro-Russian accounts, groups and pages across its platforms trying to spread anti-Ukrainian propaganda as the war in Ukraine continues to rage.

Meta's takedown of the influence campaign also coincided with what company officials described as a separate, intensified push by pro-Russian hackers to compromise the social media accounts of Ukrainian journalists, military leaders and government officials. The hacking campaign, attributed to an actor security researchers have nicknamed "Ghostwriter," appears to have succeeded with at least some Facebook accounts, Meta said.

Both initiatives underscore how groups supporting Russia's invasion of Ukraine have attempted to win the information war playing out online, not just on Facebook but on an array of social media platforms and websites.

Over the weekend, Meta said, the company became aware of roughly 40 accounts, groups and pages masquerading as real people. To pull off the deception, the disinformation agents used AI-generated profile pictures and claimed to be writing from Kyiv, according to the company.

One of the fictitious accounts pretended to be an aviation engineer; others claimed to be news editors or scientific authors, Meta said. The accounts published content on Facebook, Instagram and across the wider internet discrediting Ukraine as a failed state, among other claims, Meta said.

The company added that the influence campaign appears to be linked to another campaign Facebook disrupted in 2020. At the time, Facebook's investigation tied the earlier influence operation to people in Russia, as well as NewsFront and SouthFront, two Crimea-based alleged disinformation sites that have since been sanctioned by the US government.

Nathaniel Gleicher, Meta's head of security policy, declined to elaborate on the nature of the links, and also repeatedly declined to tell reporters how widely the more recent campaign's content may have been shared, viewed or engaged with on Meta's platforms.

But he described the campaign as "relatively small," with fewer than 4,000 Facebook followers and fewer than 500 followers on Instagram. And he added that Meta was able to disrupt the network before it could amass a large audience.

Thus far, Meta has not found any evidence of pro-Ukrainian fake activity on its platform but the company would announce if it did, Gleicher told CNN.

"Why we share these operations is to make sure that people understand and can see what's happening on all sides of any conflict," Gleicher said. "What we're seeing here is activity from actors who, from the content they're sharing and the behavior they're engaged in, appears aligned more in undermining trust of the Ukrainian government and boosting the activities of Russian actors."

Meanwhile, the campaign to hack into the social media accounts of Ukrainians has targeted "a handful" of victims, Gleicher said, adding that the effort had gone after at least one journalist and multiple Ukrainian military and government officials. Meta has notified its users who were targeted by Ghostwriter, Gleicher said.

After successfully taking control of a person's social media account, Ghostwriter will attempt to post pro-Ukrainian content, said David Agranovich, Meta's director of threat disruption. In one example, he said, a hijacked account was witnessed sharing a link to a YouTube video that purported to show Ukrainian troops surrendering. (Asked whether the video appeared to be authentic, Agranovich said he could not speculate on the YouTube content.)

The Ghostwriter campaign works by compromising a victim's email accounts — often through the use of targeted phishing attacks — and then uses that access to gain entry to the person's social media accounts.

Ghostwriter has been active since at least 2016, has targeted victims across Europe and has links to Belarus, according to the cybersecurity firm Mandiant. Last fall, the European Union claimed that Ghostwriter was linked to the Russian government.

But since the Russian invasion, Agranovich said, "we've seen a pivot in Ghostwriter's focus to, in particular, people in Ukraine."

Separately, Gleicher added, Meta is increasingly ramping up user security protections in Russia as protesters opposing the invasion have continued to organize on the company's platforms. For example, Meta will soon be rolling out a tool in Russia that it has already deployed in Ukraine allowing users to quickly "lock" their profiles, restricting access to a person's content. In addition, Meta will also be placing a notification at the top of Russian users' feeds reminding them about steps they can take to secure their accounts.

The-CNN-Wire
™ & © 2022 Cable News Network, Inc., a WarnerMedia Company. All rights reserved.